Fake RojaDirecta IPTV Apps Deliver Banking Malware to Football Fans
Summary
Threat Fabric reports that fake RojaDirecta-style Android IPTV apps promoted around major football events have distributed banking malware in Spain and Italy, exploiting sideloading and permissions such as Accessibility Services.
Key points
- Researchers observed more malicious unofficial IPTV apps masquerading as RojaDirecta before the Champions League final, with similar campaigns also seen in Italy.
- Users are lured through search results, ads, websites, and social media to sideload apps outside trusted marketplaces, bypassing app-store safeguards.
- The apps may appear functional while deploying banking malware, including Massiv and Perseus; Zombinder can embed malicious code in usable apps.
- Malware can steal credentials, intercept authentication, take over devices, and enable fraud or personal-data theft.
- Requests for Accessibility Services are a warning sign because streaming apps do not need this access, which malware can abuse to monitor input or interact with other apps.
- Threat Fabric expects piracy-related malware distribution to recur around major events such as the World Cup; it advises avoiding unofficial downloads and suspicious permissions, while banks can use mobile threat intelligence to detect malicious APKs.
Article Details
- Attack Vectors
- Malicious Android IPTV apps masquerading as RojaDirecta apps are promoted through search results, ads, imitation websites, and social media promotions, then installed manually from outside official app stores.
- The apps may appear functional while delivering banking malware in the background; the article reports use of Zombinder to embed malicious code into otherwise usable applications.
- The malware may abuse Accessibility Services and use overlays, keylogging, interception of SMS, push notifications, or authenticator apps, and remote device control.
- Defensive Notes
- Avoid installing apps from advertisements, websites, or direct download links; treat unofficial apps using familiar brands as unverified.
- Be cautious about app permission requests, especially requests for Accessibility Services when the app is for streaming.
- Banks can use mobile threat intelligence to detect malicious APKs proactively.
- The article recommends stronger collaboration among banks, telecom providers, streaming platforms, fraud experts, threat intelligence providers, and social media companies.
MITRE ATT&CK
T1404Zombinder is used to embed malicious code into otherwise usable applications.T1411The article reports use of overlays for credential theft.T1417.001The article reports banking malware using keylogging to monitor user input.T1433The malware may intercept SMS messages, push notifications, and authenticator-app activity to bypass MFA.T1434The article reports remote device control and describes malware abusing Accessibility Services to interact with other apps.T1476Malicious Android apps masquerading as RojaDirecta IPTV apps are distributed from websites and advertisements for manual installation.
Malware
HookCommand-and-Control (C2) panel of the Hook banking malwareMassivIn recent campaigns observed in Spain (and also Italy), this has included banking malware from several powerful malware families like Massiv and Perseus.PerseusIn recent campaigns observed in Spain (and also Italy), this has included banking malware from several powerful malware families like Massiv and Perseus.
Products
Tools
Countries
Italyto Spain. We are closely tracking similar campaigns targeting other countries in Europe, like for example Italy.SpainIn Spain, with millions of football enthusiasts and where premium competitions such as the UEFA Champions League are tied to paid services like Movistar Plus, a portion of viewers continues to look for free alternatives.